security: pin toolchain to go1.25.12 (fixes 1 critical + 12 high stdlib CVEs)

[sourya-deepsource]

Every advisory flagged for this repo in the Jul 2026 dependency scan is a Go stdlib issue — 1 CRITICAL and 12 HIGH, all against the declared go 1.25.3. A single toolchain pin clears all 13.

	Before	After
toolchain	(none — floor was go 1.25.3)	go1.25.12
golang.org/x/text	v0.33.0	v0.39.0

CVEs fixed

CRITICAL

• CVE-2025-68121 (CVSS 9.1) — unexpected session resumption in crypto/tls (fix 1.24.13 / 1.25.7)

HIGH (12) — CVE-2026-39822, CVE-2025-61729, CVE-2025-61726, CVE-2026-25679, CVE-2026-32283, CVE-2026-32281, CVE-2026-32280, CVE-2026-33814, CVE-2026-39836, CVE-2026-42499, CVE-2026-33811, CVE-2026-39820

go1.25.12 is the current 1.25 patch and satisfies every fix line above. CVE-2026-39822 is the binding constraint — its fix is exactly 1.25.12, so nothing lower clears the full set.

Why only the toolchain moves

The go directive stays at 1.25.3. It expresses the minimum language version and doesn't need to change; the toolchain is what determines the stdlib actually compiled in.

Worth being precise about the real-world exposure: CI uses setup-go with '1.25', which resolves to the newest 1.25.x — so CI builds were most likely already getting a patched stdlib. What was actually vulnerable was the declared floor: what the scanner reads, and what any local build or release build without an explicit pin would honour. This makes the guarantee explicit rather than incidental.

Also included

golang.org/x/text v0.33.0 → v0.39.0 for GO-2026-5970, which govulncheck flags as reachable:

command/auth/status/status.go:94:14: status.AuthStatusOptions.Run calls fmt.Fprintln,
  which eventually calls norm.Form.Properties

Not in the scan, but reachable and free to fix alongside.

Verification

• go build ./..., go vet ./... — pass
• go test ./... — all packages pass (unchanged from baseline)
• govulncheck ./... — 0 reachable vulnerabilities
• All 13 scan-flagged CVEs confirmed individually cleared

Two residual advisories remain in required modules, both unreachable and neither flagged in the scan.

🤖 Generated with Claude Code

[deepsource-io]

DeepSource Code Review

We reviewed changes in 6708c22...7859183 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene   Coverage

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Jul 31, 2026 2:25p.m.	Review ↗
Secrets		Jul 31, 2026 2:25p.m.	Review ↗
Code coverage		Jul 31, 2026 2:25p.m.	Review ↗

Code Coverage Summary

Language	Line Coverage (Overall)
Aggregate	25.4%
Go	25.4% [✓ above threshold]

➟ Additional coverage metrics may have been reported. See full coverage report ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.